CVE-2026-1317

WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name

Published: Feb 18, 2026Updated: Feb 18, 2026 Sources: CVE List NVDCWE-89

NVD MITRE

6.5CVSSMEDIUM

Am I actually vulnerable?1 Nuclei template available — see how to check your systems. How to verify

Description

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 7.37. This is due to insufficient escaping on the `file_name` parameter which is stored in the database during file upload and later used in raw SQL queries without proper sanitization. This makes it possible for authenticated attackers with Subscriber-level access or higher to append additional SQL queries into already existing queries via a malicious filename, which can be used to extract sensitive information from the database. The vulnerability can only be exploited when the 'Single Import/Export' option is enabled, and the server is running a PHP version < 8.0.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:LPrivileges Required

Low

UI:NUser Interaction

None

Scope

S:UScope

Unchanged

Impact

C:HConfidentiality

High

I:NIntegrity

None

A:NAvailability

None

Open in CVSS calculator →

Weaknesses

CWE-89

Affected Products

WP Ultimate CSV Importer – Import CSV, XML & Excel into WordPress smackcoders

On-prem

Web & CMS Plugins / wordpress-plugin

smackcoderscommercialWeb & CMS Pluginsaka wp ultimate csv importer – import csv, xml & excel into wordpress, import all pages, post types, products, orders, and users as xml & csv, export all posts, products, orders, refunds & users